Detections
Analytics

SCA: security update for motioneye (GHSA-rw9q-97r9-8gvh)

high Tenable Cloud Security Plugin ID 443801

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - motionEye (mEye) is an online interface for a piece of software called "motion," which is a video
 surveillance program with motion detection. Versions prior to 0.44.0 contain an absolute path traversal
 vulnerability in multiple media file handlers that allows an attacker to read arbitrary files from the
 filesystem. The affected handlers accept a user-controlled filename parameter and construct filesystem
 paths using `os.path.join()`. When an absolute path is supplied, Python discards the configured media
 directory and returns the attacker-supplied path directly. The application then bypasses Tornado's built-
 in path validation by overriding the relevant safety checks. As a result, an attacker can access files
 outside of the configured camera media directory, subject to the permissions of the motionEye process.
 Version 0.44.0 fixes the issue. (CVE-2026-55488)

Solution

Update the motioneye library and its related packages to version 0.44.0 or later.

See Also

https://github.com/advisories/GHSA-rw9q-97r9-8gvh

Plugin Details

Severity: High

ID: 443801

Version: Revision 1.7

Type: Local

Family: SCA Checks

Published: 6/23/2026

Updated: 7/20/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.73

Vendor

Vendor Severity: High

CVSS v2

Risk Factor: Medium

Base Score: 5

Temporal Score: 3.7

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS Score Source: CVE-2026-55488

CVSS v3

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS v4

Risk Factor: High

Base Score: 8.7

Threat Score: 7.7

Threat Vector: CVSS:4.0/E:P

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 6/23/2026

Vulnerability Publication Date: 6/23/2026

Reference Information

CVE: CVE-2026-55488

cwe: CWE-22